CN110764995B - Method, device, medium and electronic equipment for detecting file access abnormality - Google Patents
Method, device, medium and electronic equipment for detecting file access abnormalityDownload PDFInfo
- Publication number
- CN110764995B CN110764995BCN201910835048.7ACN201910835048ACN110764995BCN 110764995 BCN110764995 BCN 110764995BCN 201910835048 ACN201910835048 ACN 201910835048ACN 110764995 BCN110764995 BCN 110764995B
- Authority
- CN
- China
- Prior art keywords
- page
- information
- file
- mapping
- memory
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Prevention of errors by analysis, debugging or testing of software
- G06F11/362—Debugging of software
- G06F11/3644—Debugging of software by instrumenting at runtime
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0766—Error or fault reporting or storing
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Computer Hardware Design (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Description
Technical Field
The disclosure relates to the field of software testing, in particular to a method, a device, a medium and electronic equipment for detecting file access abnormality.
Background
A process is a running activity of a program with independent functionality with respect to a certain data set. It can apply for and own system resources, is a dynamic concept, and is an active entity. It includes not only the code of the program, but also the current activity, represented by the value of the program counter and the contents of the processing registers.
Multiple processes cannot access the same shared resource at the same time, otherwise time-dependent errors may occur, a phenomenon known as process mutual exclusion. That is, one process is accessing a shared resource and another process that is to access the shared resource must wait.
If one process reads a file, another process de-rewrites the file, an exception may occur and even cause the process to crash. For this problem, a common debugging mode is to analyze information such as call stack, register, memory, log, etc. Because the information is provided to the debugger in the original existing form in the system, the information is difficult to understand and has no visual problem. Therefore, it is difficult to analyze the problem of mutual exclusion of processes.
Disclosure of Invention
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.
The disclosure aims to provide a method, a device, a medium and an electronic device for detecting file access abnormality, which can solve at least one technical problem mentioned above. The specific scheme is as follows:
according to a specific embodiment of the present disclosure, in a first aspect, the present disclosure provides a method for detecting file access anomalies, including:
acquiring a first starting address of mapping the memory information of a first file to a memory mapping table;
acquiring first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first starting address; the first file page information is page information corresponding to the first mapping page in the first file memory information;
loading the first file page information into the first mapping page, and acquiring loading result information;
judging whether the loading result information meets page fault abnormal conditions or not;
if yes, prompting abnormal information.
According to a second aspect of the specific embodiments of the present disclosure, the present disclosure provides an apparatus for detecting file access anomalies, including:
the first starting address obtaining unit is used for obtaining a first starting address of the memory mapping table, which is mapped by the memory information of the first file;
a first file page information obtaining unit, configured to obtain first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first start address; the first file page information is page information corresponding to the first mapping page in the first file memory information;
the loading unit is used for loading the first file page information into the first mapping page and acquiring loading result information;
the judging unit is used for judging whether the loading result information meets the page fault abnormal condition;
and the abnormal information prompting unit is used for prompting abnormal information if the output result of the judging unit is yes.
According to a third aspect of the disclosure, the disclosure provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements a method of detecting a file access abnormality as claimed in any of the first aspects.
According to a fourth aspect of the present disclosure, there is provided an electronic device comprising: one or more processors; storage means for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement a method of detecting a file access exception as described in any of the first aspects.
Compared with the prior art, the scheme of the embodiment of the disclosure has at least the following beneficial effects:
the disclosure provides a method, a device, a medium and electronic equipment for detecting file access abnormality. The method comprises the following steps: acquiring a first starting address of mapping the memory information of a first file to a memory mapping table; acquiring first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first starting address; the first file page information is page information corresponding to the first mapping page in the first file memory information; loading the first file page information into the first mapping page, and acquiring loading result information; judging whether the loading result information meets page fault abnormal conditions or not; if yes, prompting abnormal information. The method and the device can quickly locate the abnormal file and acquire the related information of the file.
Drawings
The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings. The same or similar reference numbers will be used throughout the drawings to refer to the same or like elements. It should be understood that the figures are schematic and that elements and components are not necessarily drawn to scale. In the drawings:
FIG. 1 illustrates a flow chart of a method of detecting file access anomalies according to an embodiment of the present disclosure;
FIG. 2 illustrates a schematic diagram of a method of detecting file access anomalies according to an embodiment of the present disclosure;
FIG. 3 illustrates a block diagram of a unit of an apparatus for detecting file access anomalies according to an embodiment of the disclosure;
fig. 4 shows a schematic diagram of an electronic device connection structure according to an embodiment of the present disclosure.
Detailed Description
Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure have been shown in the accompanying drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.
It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order and/or performed in parallel. Furthermore, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.
The term "including" and variations thereof as used herein are intended to be open-ended, i.e., including, but not limited to. The term "based on" is based at least in part on. The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments. Related definitions of other terms will be given in the description below.
It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.
It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.
The names of messages or information interacted between the various devices in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.
Alternative embodiments of the present disclosure are described in detail below with reference to the drawings.
The first embodiment provided in the present disclosure is an embodiment of a method for detecting file access anomalies.
Embodiments of the present disclosure will be described in detail below with reference to fig. 1 and 2, where fig. 1 is a flowchart of a method for detecting file access anomalies provided by embodiments of the present disclosure; FIG. 2 illustrates a schematic diagram of a method of detecting file access anomalies according to an embodiment of the present disclosure.
Step S100, a first file is opened to obtain first file memory information stored in a memory.
The first file memory space is a space in which first file memory information is stored in the memory.
The first file memory information refers to information stored in the memory of the opened first file. For example, in the C language, a specified file is opened using an open instruction, and a file handle is obtained; the file handle herein may represent the memory information of the specified file.
In step S101, a first starting address of the memory mapping table mapped by the first file memory information is obtained.
Multiple processes cannot access the same shared resource at the same time, otherwise time-dependent errors may occur, a phenomenon known as process mutual exclusion. That is, one process is accessing a shared resource and another process that is to access the shared resource must wait. Otherwise, an exception may occur, even causing the process to crash.
The physical memory is divided into fixed-size blocks, called frames or page frames, while the logical memory is also divided into equally-sized blocks, called pages or pages.
In order to analyze the problem of mutual exclusion of files in a process, the embodiment of the disclosure adopts a memory mapping table mode for processing the files. That is, a space corresponding to the memory information of the first file, that is, the first mapping space is reserved in the memory mapping table, the opened file is paged and loaded into the space of the corresponding page of the memory mapping table according to the requirement, and the abnormal information of the file operation is obtained according to the loading result.
Step S102, obtaining first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first starting address.
The first mapped page is the page to be loaded in the memory map.
The first file page is a page in the first file memory information.
The first file page information is page information corresponding to the first mapping page in the first file memory information. For example, if a total of 4 mapping pages A1, B1, C1 and D1 are reserved for the first file memory information in the memory mapping table, the number of file pages corresponding to the mapping pages in the first file memory information is a total of 4, B2, C2 and D2, respectively, when the mapping page B1 is to be read in the memory mapping table, if no mapping page information exists in the mapping page B1 of the memory mapping table, the information in the mapping page B2 file is loaded into the mapping page B1 of the memory mapping table.
The memory mapping table not only comprises the first mapping space, but also comprises the space required by other applications, and the information stored in the space is stored in the memory mapping table in units of pages. The page feature information includes page sequence number information in the memory map.
The first start address is a start address in a second mapped page. That is, the first starting address is the first address of both the first mapped space in the memory map and the first mapped page (i.e., the second mapped page) in the first mapped space.
The step of obtaining the first file page information based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first start address includes the following steps:
step S102-21, obtaining first offset information based on the second page sequence number information of the second mapping page, the first page sequence number information of the first mapping page and a preset page length.
The first offset information refers to address length information from the first start address to a page start address of the first mapped page.
For example, continuing the above example, the second mapped page is an A1 mapped page, the first mapped page is a C1 mapped page, the preset page length is 1k (1k=1024), the second page sequence number information of the A1 mapped page in the memory map is 5, the first page sequence number information of the C1 mapped page in the memory map is 7, and the first offset information is 2k.
Step S102-22, acquiring a page start address of the first file page according to the first file memory information and the first offset information.
For example, in the C language, the file handle obtained after the first file is opened by the open instruction represents the first file memory information, and the read pointer may be located at the position of the first offset information in the first file memory information, that is, the page start address of the first file page by the lseek instruction.
Step S102-23, acquiring first file page information based on the page start address and the preset page length of the first file page.
For example, continuing with the above example, the information of the preset page length is read by the read instruction starting from the page start address of the first file page, thereby acquiring the first file page information.
Alternatively, embodiments of the present disclosure provide a checking mechanism, that is, loading the mapping page with corresponding file page information only if the read mapping page information is empty. Before the first file page information is obtained based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first starting address, the method further comprises the following steps:
step S102-11, reading the third mapping page information.
And step S102-12, judging whether the third mapping page information is empty or not.
And step S102-13, if yes, judging the third mapping page as the first mapping page.
And step S102-14, if not, stopping loading page information corresponding to the third mapping page in the first file memory information to the third mapping page.
The steps can prevent the first file memory information from being repeatedly loaded into the memory mapping table.
Step S103, loading the first file page information into the first mapping page, and obtaining loading result information.
For example, a mmap instruction is used to load first file page information in the first file memory information into a first mapping page in the memory mapping table.
The mmap instruction must be mapped in page_size (representing a predetermined PAGE length), and the memory can only be mapped in PAGE units.
Step S104, judging whether the loading result information meets the page fault abnormal condition.
The page fault exception condition includes: SIGBUS exception condition of system.
For example, the process A opens the C file to obtain the memory information of the C1 file, and simultaneously, the process B also opens the C file to obtain the memory information of the C2 file; when the B process modifies the memory information of the C1 file, the A process is reading the memory information of the C1 file mapped into the memory mapping table, and the SIGBUS abnormality of the system occurs.
The loading result information comprises loading return information and/or loading length information.
The judging whether the loading result information meets the SIGBUS abnormal condition of the system at least comprises one of the following judging modes:
in the first determination mode, it is determined whether the load return information is not the first start address.
For example, with a mmap instruction, if the load return information is the first starting address, then the load operation is indicated as successful; if the load return information is MAP_FAILED (i.e., -1), then the load failure is indicated.
And judging whether the loading length information is not the preset page length or not in the second judging mode.
Step S105, if yes, prompting abnormal information.
The anomaly information includes first path information and/or first file size information of the first file.
The prompting abnormal information comprises the following steps:
step S105-1, obtaining first file header mapping information from the memory mapping table based on the first start address.
Each file has a header, which is generally disposed at a start position of the file and is different according to a type of the file, and mainly includes path information and/or file size information of the file.
Step S105-2, obtaining and prompting abnormal information based on the first file header mapping information.
The embodiment of the invention can quickly locate the abnormal file and acquire the related information of the file.
Corresponding to the first embodiment provided by the present disclosure, the present disclosure also provides a second embodiment, namely, an apparatus for detecting file access abnormality. Since the second embodiment is substantially similar to the first embodiment, the description is relatively simple, and the relevant portions will be referred to the corresponding descriptions of the first embodiment. The device embodiments described below are merely illustrative.
Fig. 3 illustrates an embodiment of an apparatus for detecting file access anomalies provided by the present disclosure. Fig. 3 is a block diagram of a unit of an apparatus for detecting file access anomalies according to an embodiment of the present disclosure.
Referring to fig. 3, the disclosure provides an apparatus for detecting file access abnormality, including: the firststart address unit 301 is acquired, the first filepage information unit 302 is acquired, theloading unit 303, the judgingunit 304, and theabnormality information unit 305 is prompted.
The first startaddress obtaining unit 301 is configured to obtain a first start address where the memory information of the first file is mapped to the memory mapping table;
a first file pageinformation obtaining unit 302, configured to obtain first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first start address; the first file page information is page information corresponding to the first mapping page in the first file memory information;
aloading unit 303, configured to load the first file page information into the first mapping page, and obtain loading result information;
a judgingunit 304, configured to judge whether the loading result information meets a page fault abnormal condition;
and a promptabnormal information unit 305, configured to prompt abnormal information if the output result of the judgingunit 304 is yes.
Optionally, the anomaly information includes first path information and/or first file size information of the first file;
the alertabnormality information unit 305 includes:
a sub-unit for acquiring first header mapping information, configured to acquire first header mapping information from the memory mapping table based on the first start address;
and the prompt abnormal information subunit is used for acquiring and prompting abnormal information based on the first file header mapping information.
Optionally, the page feature information includes page sequence number information in the memory mapping table;
the first start address is a start address in a second mapped page;
in the acquire first filepage information unit 302, it includes:
a sub-unit for acquiring first offset information, which is used for acquiring first offset information based on the second page sequence number information of the second mapping page, the first page sequence number information of the first mapping page and a preset page length; wherein the first offset information refers to address length information from the first start address to a page start address of the first mapped page;
a sub-unit for acquiring a page start address of a first file page, which is used for acquiring the page start address of the first file page according to the first file memory information and the first offset information;
and the first file page information acquisition subunit is used for acquiring first file page information based on the page starting address of the first file page and the preset page length.
Optionally, in the acquiring the first filepage information unit 302, the method further includes:
a third mapping page information reading subunit, configured to read third mapping page information;
a third mapping page information judging subunit, configured to judge whether the third mapping page information is empty;
a first mapping page judging subunit, configured to judge that a third mapping page is the first mapping page if the output result of the third mapping page judging subunit is yes;
and the loading stopping subunit is configured to stop loading page information corresponding to the third mapping page in the first file memory information to the third mapping page if the output result of the third mapping page information judging subunit is "no".
Optionally, in the apparatus, further includes:
and the file opening unit is used for opening the first file to obtain the first file memory information stored in the memory.
Optionally, the page fault abnormal condition includes: SIGBUS exception condition of system.
Optionally, the loading result information includes loading return information and/or loading length information;
the judging whether the loading result information meets the SIGBUS abnormal condition of the system at least comprises one of the following judging subunits:
a first judging subunit, configured to judge whether the load return information is not the first start address;
and the second judging subunit is used for judging whether the loading length information is not the preset page length.
The embodiment of the invention can quickly locate the abnormal file and acquire the related information of the file.
The embodiment of the disclosure provides a third embodiment, namely an electronic device, which is used for detecting a file access abnormality, and comprises: at least one processor; and a memory communicatively coupled to the at least one processor; wherein,,
the memory stores instructions executable by the one processor to enable the at least one processor to perform the method of detecting file access anomalies as described in the first embodiment.
The present disclosure provides a fourth embodiment, namely, a computer storage medium storing computer-executable instructions that are executable to perform the method of detecting a file access abnormality as described in the first embodiment.
Referring now to fig. 4, a schematic diagram of an electronic device suitable for use in implementing embodiments of the present disclosure is shown. The terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and the like, and stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 4 is merely an example and should not be construed to limit the functionality and scope of use of the disclosed embodiments.
As shown in fig. 4, the electronic device may include a processing means (e.g., a central processor, a graphics processor, etc.) 401, which may perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 402 or a program loaded from a storage means 408 into a Random Access Memory (RAM) 403. In theRAM 403, various programs and data required for the operation of the electronic device are also stored. Theprocessing device 401, theROM 402, and theRAM 403 are connected to each other by abus 404. An input/output (I/O)interface 405 is also connected tobus 404.
In general, the following devices may be connected to the I/O interface 405:input devices 406 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; anoutput device 407 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like;storage 408 including, for example, magnetic tape, hard disk, etc.; and acommunication device 409. The communication means 409 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. While fig. 4 shows an electronic device having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead.
In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a non-transitory computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network viacommunications device 409, or fromstorage 408, or fromROM 402. The above-described functions defined in the methods of the embodiments of the present disclosure are performed when the computer program is executed by theprocessing device 401.
It should be noted that the computer readable medium described in the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.
In some implementations, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol ), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the internet (e.g., the internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.
The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device.
Computer program code for carrying out operations of the present disclosure may be written in one or more programming languages, including, but not limited to, an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).
The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units involved in the embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. Wherein the names of the units do not constitute a limitation of the units themselves in some cases.
The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.
In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
The foregoing description is only of the preferred embodiments of the present disclosure and description of the principles of the technology being employed. It will be appreciated by persons skilled in the art that the scope of the disclosure referred to in this disclosure is not limited to the specific combinations of features described above, but also covers other embodiments which may be formed by any combination of features described above or equivalents thereof without departing from the spirit of the disclosure. Such as those described above, are mutually substituted with the technical features having similar functions disclosed in the present disclosure (but not limited thereto).
Moreover, although operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order. In certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the present disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.
Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are example forms of implementing the claims.
Claims (8)
1. A method of detecting file access anomalies, comprising:
acquiring a first starting address of mapping the memory information of a first file to a memory mapping table;
acquiring first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first starting address; the first file page information is page information corresponding to the first mapping page in the first file memory information;
loading the first file page information into the first mapping page, and acquiring loading result information;
judging whether the loading result information meets page fault abnormal conditions or not;
if yes, prompting abnormal information;
the abnormal information comprises first path information and/or first file size information of a first file;
the prompting abnormal information comprises:
acquiring first file header mapping information from the memory mapping table based on the first starting address;
acquiring and prompting abnormal information based on the first file header mapping information;
the page characteristic information comprises page sequence number information in the memory mapping table;
the first start address is a start address in a second mapped page;
the obtaining the first file page information based on the page feature information of the first mapping page to be loaded in the memory mapping table and the first start address includes:
acquiring first offset information based on second page sequence number information of the second mapping page, first page sequence number information of the first mapping page and preset page length; wherein the first offset information refers to address length information from the first start address to a page start address of the first mapped page;
acquiring a page starting address of the first file page according to the first file memory information and the first offset information;
and acquiring first file page information based on the page starting address of the first file page and a preset page length.
2. The method of claim 1, further comprising, prior to the acquiring first offset information based on the second page sequence number information of the second mapped page, the first page sequence number information of the first mapped page, and a preset page length:
reading the third mapping page information;
judging whether the third mapping page information is empty or not;
if yes, the third mapping page is judged to be the first mapping page.
3. The method of claim 1, further comprising, prior to said retrieving the first file memory information mapped to the first starting address in the memory map table:
and opening the first file to obtain the memory information of the first file stored in the memory.
4. The method of claim 1, wherein the page fault exception condition comprises: SIGBUS exception condition of system.
5. The method according to claim 4, wherein the loading result information comprises loading return information and/or loading length information;
the judging whether the loading result information meets the SIGBUS abnormal condition of the system at least comprises one of the following judging modes:
judging whether the loading return information is not the first starting address or not;
and judging whether the loading length information is not the preset page length.
6. An apparatus for detecting file access anomalies, comprising:
the first starting address obtaining unit is used for obtaining a first starting address of the memory mapping table, which is mapped by the memory information of the first file;
a first file page information obtaining unit, configured to obtain first file page information based on page feature information of a first mapping page to be loaded in the memory mapping table and the first start address; the first file page information is page information corresponding to the first mapping page in the first file memory information;
the loading unit is used for loading the first file page information into the first mapping page and acquiring loading result information;
the judging unit is used for judging whether the loading result information meets the page fault abnormal condition;
the abnormal information prompting unit is used for prompting abnormal information if the output result of the judging unit is yes;
the abnormal information comprises first path information and/or first file size information of a first file; the prompt abnormal information unit is used for acquiring first file header mapping information from the memory mapping table based on the first starting address; acquiring and prompting abnormal information based on the first file header mapping information;
the page characteristic information comprises page sequence number information in the memory mapping table;
the first start address is a start address in a second mapped page;
a sub-unit for acquiring first offset information, which is used for acquiring first offset information based on the second page sequence number information of the second mapping page, the first page sequence number information of the first mapping page and a preset page length; wherein the first offset information refers to address length information from the first start address to a page start address of the first mapped page;
a sub-unit for acquiring a page start address of a first file page, which is used for acquiring the page start address of the first file page according to the first file memory information and the first offset information;
and the first file page information acquisition subunit is used for acquiring first file page information based on the page starting address of the first file page and the preset page length.
7. A computer readable storage medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements the method according to any one of claims 1 to 5.
8. An electronic device, comprising:
one or more processors;
storage means for storing one or more programs which when executed by the one or more processors cause the one or more processors to implement the method of any of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910835048.7ACN110764995B (en) | 2019-09-05 | 2019-09-05 | Method, device, medium and electronic equipment for detecting file access abnormality |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910835048.7ACN110764995B (en) | 2019-09-05 | 2019-09-05 | Method, device, medium and electronic equipment for detecting file access abnormality |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110764995A CN110764995A (en) | 2020-02-07 |
| CN110764995Btrue CN110764995B (en) | 2023-06-06 |
Family
ID=69329409
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910835048.7AActiveCN110764995B (en) | 2019-09-05 | 2019-09-05 | Method, device, medium and electronic equipment for detecting file access abnormality |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110764995B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111753238A (en)* | 2020-06-05 | 2020-10-09 | 北京有竹居网络技术有限公司 | Data mapping method and device and electronic equipment |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5386522A (en)* | 1991-12-30 | 1995-01-31 | International Business Machines, Corp. | Dynamic physical address aliasing during program debugging |
| CN102388368A (en)* | 2011-09-20 | 2012-03-21 | 华为技术有限公司 | A memory monitoring method and device |
| CN105824749A (en)* | 2016-03-09 | 2016-08-03 | 上海博达数据通信有限公司 | Method for analyzing abnormality of user-mode progress under linux system |
| CN106909509A (en)* | 2017-03-01 | 2017-06-30 | 四川大学 | A kind of virtual machine process code without acting on behalf of paging type gauging system and method |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7383414B2 (en)* | 2004-05-28 | 2008-06-03 | Oracle International Corporation | Method and apparatus for memory-mapped input/output |
| US7447942B2 (en)* | 2005-07-19 | 2008-11-04 | Microsoft Corporation | Fast data breakpoint emulation |
| US7647471B2 (en)* | 2006-11-17 | 2010-01-12 | Sun Microsystems, Inc. | Method and system for collective file access using an mmap (memory-mapped file) |
| TW201220186A (en)* | 2010-11-04 | 2012-05-16 | Inventec Corp | Data protection method for damaged memory cells |
| JP2012150535A (en)* | 2011-01-17 | 2012-08-09 | Fujitsu Ltd | Program verification method and program verification program |
| CN105830022B (en)* | 2014-11-28 | 2019-03-08 | 华为技术有限公司 | Method and apparatus for accessing files |
| US10261703B2 (en)* | 2015-12-10 | 2019-04-16 | International Business Machines Corporation | Sharing read-only data among virtual machines using coherent accelerator processor interface (CAPI) enabled flash |
| CN109656779A (en)* | 2018-12-07 | 2019-04-19 | 广州市百果园信息技术有限公司 | Internal memory monitoring method, device, terminal and storage medium |
- 2019
- 2019-09-05CNCN201910835048.7Apatent/CN110764995B/enactiveActive
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5386522A (en)* | 1991-12-30 | 1995-01-31 | International Business Machines, Corp. | Dynamic physical address aliasing during program debugging |
| CN102388368A (en)* | 2011-09-20 | 2012-03-21 | 华为技术有限公司 | A memory monitoring method and device |
| CN105824749A (en)* | 2016-03-09 | 2016-08-03 | 上海博达数据通信有限公司 | Method for analyzing abnormality of user-mode progress under linux system |
| CN106909509A (en)* | 2017-03-01 | 2017-06-30 | 四川大学 | A kind of virtual machine process code without acting on behalf of paging type gauging system and method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110764995A (en) | 2020-02-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112084024B (en) | Memory monitoring method, device, medium and electronic equipment | |
| CN111555940B (en) | Client test method and device, electronic equipment and computer readable storage medium | |
| CN111611145B (en) | Breakdown information collection method and device, storage medium and electronic equipment | |
| CN110865898B (en) | Method, device, medium and equipment for converging crash call stack | |
| CN113391860B (en) | Service request processing method and device, electronic equipment and computer storage medium | |
| CN111813641B (en) | Method, device, medium and equipment for collecting crash information | |
| CN110727566B (en) | Method, device, medium and electronic equipment for acquiring process crash information | |
| CN111309304B (en) | Method, device, medium and electronic equipment for generating IDL file | |
| CN111459822B (en) | Method, device, equipment and readable medium for extracting system component data | |
| CN112379967B (en) | Simulator detection method, device, equipment and medium | |
| CN110851281A (en) | Method, server, terminal, system and storage medium for detecting memory leakage | |
| CN111625422B (en) | Thread monitoring method, thread monitoring device, electronic equipment and computer readable storage medium | |
| CN110673986A (en) | Memory operation abnormity capturing method, device, terminal and storage medium | |
| CN112099982A (en) | Collapse information positioning method, device, medium and electronic equipment | |
| CN117992204A (en) | Memory detection method, device, equipment and storage medium | |
| CN110764995B (en) | Method, device, medium and electronic equipment for detecting file access abnormality | |
| CN110888773B (en) | Method, device, medium and electronic equipment for acquiring thread identification | |
| CN112306683A (en) | Function hijacking method, device, medium and electronic equipment | |
| CN111538717A (en) | Data processing method and device, electronic equipment and computer readable medium | |
| CN111949528A (en) | Memory leak detection method, device, electronic device and storage medium | |
| CN114296986B (en) | Memory leakage positioning method, device, medium and electronic equipment | |
| CN111310175A (en) | iOS application safety monitoring and protecting method and device based on plug-in | |
| CN112084086B (en) | Information collection method, device, medium and electronic equipment | |
| CN111984496B (en) | Method, device, medium and electronic equipment for monitoring stack memory leakage | |
| CN116263824A (en) | Resource access method, device, storage medium and electronic device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |